feat(profiles): general update.

apparmor.d/profiles-m-r/nologin

@@ -9,8 +9,12 @@ include <tunables/global>
 @{exec_path} = /{usr/,}{s,}bin/nologin
 profile nologin @{exec_path} {
   include <abstractions/base>
+  include <abstractions/consoles>
+  include <abstractions/nameservice-strict>
 
   @{exec_path} mr,
 
+  owner @{PROC}/@{pid}/loginuid r,
+
   include if exists <local/nologin>
 }

apparmor.d/profiles-m-r/pkttyagent

@@ -30,8 +30,9 @@ profile pkttyagent @{exec_path} {
   
   dbus receive bus=system path=/org/freedesktop/PolicyKit[0-9]/AuthenticationAgent
        interface=org.freedesktop.PolicyKit1.AuthenticationAgent
-       member=BeginAuthentication,
-  
+       member={BeginAuthentication,CancelAuthentication}
+       peer=(name=:*, label=polkitd),
+
   dbus receive bus=system path=/org/freedesktop/PolicyKit[0-9]/Authority
        interface=org.freedesktop.PolicyKit[0-9].Authority
        member=Changed,

apparmor.d/profiles-m-r/qemu-ga

@@ -6,7 +6,7 @@ abi <abi/3.0>,
 
 include <tunables/global>
 
-@{exec_path} = /{usr/,}bin/qemu-ga
+@{exec_path} = /{usr/,}{s,}bin/qemu-ga
 profile qemu-ga @{exec_path} {
   include <abstractions/base>
 

apparmor.d/profiles-m-r/run-parts

@@ -116,7 +116,8 @@ profile run-parts @{exec_path} {
   /etc/kernel/prerm.d/dkms                    rCx -> kernel,
 
   owner /tmp/#[0-9]*[0-9] rw,
-  owner /tmp/file* rw,
+
+  /dev/tty[0-9]* rw,
 
   profile motd {
     include <abstractions/base>
@@ -152,6 +153,7 @@ profile run-parts @{exec_path} {
 
     @{PROC}/@{pids}/mounts r,
 
+    /dev/tty[0-9]* rw,
   }
 
   profile kernel {